Media Library Assistant WordPress plugin: Blind SQL injection

Summary

The Media Library Assistant WordPress plugin up to and including version 3.42 contains a blind SQL injection vulnerability (CWE-89). An attacker with a low-privilege account on a WordPress site can inject SQL commands and may read, modify or delete database content, including user accounts and private data. Exploitation is not known to be active, and public proof of concept code has not been found.

Affected

• Media Library Assistant WordPress plugin (slug media-library-assistant) from unknown start version through 3.42
• CVSS 3.1 base score 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L)

Fixed in

• Version 3.43 according to Patchstack; the fix version is not yet confirmed on the WordPress.org changelog

Workaround

• No vendor-documented workaround known.
• If an update is not possible, deactivate the plugin until it is patched.

Exploitation

• Not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no.
• No public proof of concept found.
• Patchstack rates the priority as low and considers exploitation unlikely; sources disagree on severity.

Our recommendation

• Update the plugin to version 3.43 or later and confirm the version on the WordPress.org plugin page before rollout.
• Check all WordPress sites for this plugin, prioritising sites with user accounts below administrator level and client-hosted sites.
• Review user accounts and remove unused low-privilege accounts.
• Monitor web and database logs for unusual SQL errors or requests to the plugin.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• WordPress.org plugin page wordpress.org
• WPScan plugin page wpscan.com
• OpenCVE CVE-2026-115948 app.opencve.io
• Strix CVE-2026-115948 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:07.